Autovest Privacy Policy

Effective September 11, 2026 · Huzzeffah LLC ("Autovest", "we") · autovest.huzzeffah.com

Short version: we collect only what the autopilot needs to move your money: your identity (Google sign-in), your card or bank details (Stripe — we never see the raw numbers), and your bank transactions (Stripe Financial Connections) so the engine can compute your rolling spend. Your data stays in the US. We do not sell it. We do not share it except with the processors listed below, who need it to run the service.

1. Who we are

Autovest is an automated micro-investing service operated by Huzzeffah LLC. It watches your linked bank account's spending, and invests small fixed amounts into PAX Gold (PAXG), a token backed 1:1 by fine troy ounces of gold held by Paxos Trust Company. When you liquidate, we send the proceeds back to your linked account.

2. What we collect

Category	Examples	Why
Identity	Your Google account email and name (via Sign in with Google)	Create and protect your account
Payment method	Card details and bank-connection tokens, held by Stripe	Charge your investments; we use Stripe and never see or store full card numbers ourselves
Bank transactions	Amounts, dates, and merchant descriptions from accounts you link through Stripe Financial Connections	Compute the rolling spend that triggers an investment; detect our own charges so you are never double-billed
Investment ledger	Charges, gold purchased (in troy ounces), sales, payouts, fees	Show you exactly what you own and what everything cost
Technical logs	Timestamps, request logs needed to operate and secure the service	Run, debug, and audit the service

3. What we deliberately do NOT collect

Your bank login username/password — those go directly to your bank (or Stripe's secure connection flow) and are never visible to Autovest.
Your full card number — Stripe tokenizes it; we hold only a reference.
Behavioral advertising data, contact lists, or anything beyond what the autopilot needs.

4. Where your data is stored

All data is stored in the United States — on our managed servers (InteServer US region) and within Stripe's US infrastructure. We do not store financial-connection data outside the US, consistent with Stripe Financial Connections requirements.

5. Who we share with

Processor	What they do	What they get
Stripe, Inc.	Card charges, subscriptions, bank connections and transaction feeds (Financial Connections)	Payment details, bank-connection tokens, transaction data
Paxos Trust Company	Custody and redemption of PAX Gold	Only what an on-chain gold token requires — no personal data beyond public blockchain records
Jupiter (on Solana)	Token swap routing (USDC ⇄ PAXG)	Only the public blockchain transaction — no personal data
Google	Sign in with Google	Your login identity (email, name)
Magic (inc.)	Wallet signing infrastructure	Your login identity (email)

We do not sell your personal data. We do not share it for anyone else's marketing. We may disclose data only if legally required (for example, a valid subpoena), and we will tell you unless the law forbids it.

6. Blockchain notices

Gold purchases are recorded on the Solana public blockchain. Blockchain records are public and permanent; they contain wallet addresses, not your name. Once a transaction is on-chain, neither Autovest nor anyone else can erase it. This is inherent to how the product works.

7. How long we keep data

Investment ledger: as long as your account is open (you need it to see what you own), plus the period required by tax and financial-record rules.
Bank transactions: retained only for the rolling window and audit needs; fixed feeds are pruned on a rolling schedule once they are older than needed.
Account deletion: you can delete your account at any time; we remove personal data within 30 days, except records we must keep by law (tax/financial rules). Blockchain records cannot be deleted — this is a property of public blockchains, not our choice.

8. Your choices and rights

Pause the autopilot at any time from the app — your window freezes and nothing is charged while it is paused.
Unlink your bank at any time (in the app or via Stripe's dashboard); we stop receiving new transactions immediately.
Delete your account — see §7.
Ask us anything — access, correction, export, or deletion requests: [email protected]. We answer within 30 days.

You also have the right to complain to your state's attorney general if you believe your rights were violated.

9. Security

Secrets (API keys, signing material) live in encrypted files outside the codebase; the autopilot's signing key never leaves its secure environment. Bank login credentials are handled exclusively by Stripe and your bank — we architecturally cannot mishandle what we never receive. If a breach affects your data, we will notify you and regulators as the law requires, without undue delay.

10. Children

Autovest is not for anyone under 18. We do not knowingly collect data from children.

11. Changes to this policy

If we change this policy materially, we will email the address on your account and show a notice in the app at least 14 days before the change takes effect. Past versions are available on request.

12. Contact

Huzzeffah LLC — [email protected]